Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

dQwwXsTxxeE.exe

windows7-x64

10

dQwwXsTxxeE.exe

windows10-2004-x64

10

dQwwXsTxxeE.exe

android-9-x86

dQwwXsTxxeE.exe

android-10-x64

dQwwXsTxxeE.exe

android-11-x64

dQwwXsTxxeE.exe

macos-10.15-amd64

dQwwXsTxxeE.exe

ubuntu-18.04-amd64

dQwwXsTxxeE.exe

debian-9-armhf

dQwwXsTxxeE.exe

debian-9-mips

dQwwXsTxxeE.exe

debian-9-mipsel

Resubmissions

14/01/2025, 07:08 UTC

250114-hyh64a1jg1 10

14/01/2025, 06:16 UTC

250114-g1z2ys1ndq 10

20/06/2022, 13:20 UTC

220620-qk384sdder 10

Analysis

  • max time kernel
    296s
  • max time network
    293s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2025, 07:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dQwwXsTxxeE.exe

  • Size

    202KB

  • MD5

    88e3eeefbb87b4534e3715ef59f81173

  • SHA1

    471e2130d96d02a018cdf877d963c98a631246cd

  • SHA256

    454a0228ab3aca978bb8da603e1f1ef783d2247f95d186f2f46c5e050d12ece3

  • SHA512

    bcc12fa79fae920412874104c628fb14d8d77418dd9e9e392550eebd2d513ee9d2497b4a8ed1606d50220572c3125120df04d79e857c68e5724aed73e0884eb5

  • SSDEEP

    3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIvXcZVg9FMMywQakxalJR0:QLV6Bta6dtJmakIM5LVgLMMywQVol0

Score
10/10
nanocorediscoveryevasionkeyloggerpersistencespywarestealertrojan

Malware Config

Signatures

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Nanocore family
    nanocore
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 30 IoCs
  • Drops file in Program Files directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dQwwXsTxxeE.exe
    C:\Users\Admin\AppData\Local\Temp\dQwwXsTxxeE.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
    1⤵
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2112

Network

  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    35.157.111.131
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    35.157.111.131
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.124.67.191
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.124.67.191
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    35.157.111.131
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.124.67.191
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.126.224.214
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.124.67.191
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    35.157.111.131
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.126.224.214
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.126.224.214
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.68.56.232
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.68.56.232
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.68.56.232
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.68.56.232
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.68.56.232
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.124.67.191
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.68.56.232
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.124.67.191
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.126.224.214
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.126.224.214
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.124.67.191
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.124.67.191
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.124.67.191
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.125.188.168
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    35.157.111.131
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.68.56.232
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    35.157.111.131
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.67.15.169
  • flag-us
    DNS
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    Remote address:
    8.8.4.4:53
    Request
    7.tcp.eu.ngrok.io
    IN A
    Response
    7.tcp.eu.ngrok.io
    IN A
    3.124.67.191
  • 35.157.111.131:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 35.157.111.131:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.124.67.191:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 3.124.67.191:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 35.157.111.131:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.124.67.191:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 3.126.224.214:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.124.67.191:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 35.157.111.131:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 3.126.224.214:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.126.224.214:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.68.56.232:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 3.68.56.232:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.68.56.232:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.68.56.232:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 3.68.56.232:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.124.67.191:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.68.56.232:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 3.124.67.191:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.126.224.214:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.126.224.214:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 3.124.67.191:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.124.67.191:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.124.67.191:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 3.125.188.168:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 35.157.111.131:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.68.56.232:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 35.157.111.131:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.67.15.169:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 3.124.67.191:18009
    7.tcp.eu.ngrok.io
    dQwwXsTxxeE.exe
    152 B
     120 B
     3
    3
  • 127.0.0.1:18009
    dQwwXsTxxeE.exe
  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    35.157.111.131

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    35.157.111.131

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.124.67.191

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.124.67.191

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    35.157.111.131

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.124.67.191

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.126.224.214

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.124.67.191

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    35.157.111.131

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.126.224.214

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.126.224.214

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.68.56.232

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.68.56.232

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.68.56.232

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.68.56.232

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.68.56.232

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.124.67.191

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.68.56.232

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.124.67.191

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.126.224.214

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.126.224.214

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.124.67.191

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.124.67.191

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.124.67.191

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.125.188.168

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    35.157.111.131

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.68.56.232

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    35.157.111.131

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.67.15.169

  • 8.8.4.4:53
    7.tcp.eu.ngrok.io
    dns
    dQwwXsTxxeE.exe
    63 B
     79 B
     1
    1

    DNS Request

    7.tcp.eu.ngrok.io

    DNS Response

    3.124.67.191

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2112-0-0x0000000074781000-0x0000000074782000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2112-1-0x0000000074780000-0x0000000074D2B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2112-2-0x0000000074780000-0x0000000074D2B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/2112-5-0x0000000074780000-0x0000000074D2B000-memory.dmp

    Filesize

    5.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.